Skip to content
OpenAdvisories
High WID-SEC-2026-3145 23 CVEs

Kibana: Mehrere Schwachstellen

Published Sep 1, 2026 · Updated Sep 2, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 23

  • High 8.3
    CVE-2026-63137

    Incorrect Authorization in Kibana Leading to Privilege Escalation

    Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the p…

    Elastic Kibana
  • High 7.3
    CVE-2026-78590

    Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings writ…

    Elastic Kibana
  • High 7.3
    CVE-2026-78592

    Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-33465

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive reso…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-63138

    Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

    Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input …

    Elastic Kibana
  • Medium 6.5
    CVE-2026-72628

    Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service

    Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larg…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-72644

    Uncaught Exception in Kibana Leading to Denial of Service

    Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted …

    Elastic Kibana
  • Medium 6.5
    CVE-2026-72652

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may r…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-72654

    Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

    Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed w…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-72682

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-78586

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consu…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-78599

    Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access co…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-78608

    Missing Authorization in Kibana Leading to Information Disclosure

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server cr…

    Elastic Kibana
  • Medium 6.3
    CVE-2026-78591

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken …

    Elastic Kibana
  • Medium 5.5
    CVE-2026-78601

    Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privil…

    Elastic Kibana
  • Medium 5.4
    CVE-2026-72641

    Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerat…

    Elastic Kibana
  • Medium 5.4
    CVE-2026-78598

    Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

    Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privile…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-72633

    Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

    Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasti…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-78584

    Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure

    Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query ident…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-78597

    Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

    Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access co…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-78603

    Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authoriza…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-82293

    Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

    Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functi…

    Elastic Kibana
  • Medium 4.2
    CVE-2026-78606

    Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

    Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentic…

    Elastic Kibana

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-70067, EUVD-2026-70064, EUVD-2026-70063, EUVD-2026-70062, EUVD-2026-70061, EUVD-2026-70060, EUVD-2026-70054, EUVD-2026-70059

  2. #1

    Initiale Fassung

References